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IN THE CLAIMS 

For the convenience of the Examiner, all pending claims 
of the present Application are shown below whether or not an 
amendment has been made. Please refer to any attached sheets 
showing a marked-up version of any amendments to the Claims. 
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9. A method for updating a first version of a program 
operating at a network site, comprising: 

in response to an automated /event, automatically 
downloading from a remote site any update for the program; 

installing a downloaded update to generate a second 
version of the program; 

after installation of the/ downloaded update, determining 
whether the second versign of the program is operating 
correctly; 

in response to correct operation of the second version, 
operating the second /version of the program in place of the 
first version at th^ network site; and 

m response )lo incorrect operation of the second version, 
restoring the ^rst version of the program for operation at 
the network site, 
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10. A method for updating a first version of a program 
operating at a network site, comprising: 

in response to an automated event, automatically 
downloading from a remote site any update for the program; 

installing a downloaded update to generate a second 
version of the program; and / 

operating the second version of the program in place of 
the first version at the network site; 

distributing the downloaded update to a disparate network 
site operating the first version of the program; 

installing the downloaded update to generate the second 
version of the program at/ the disparate network site; and 

operating the second version of the program in place of 
the first version at the/ disparate network site. 
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11. A method for updating a first /version of a program 
operating at a network site, comprising: 

m response to an automated / event, automatically 
downloading from a remote site any update for the program; 

installing a downloaded update/ to generate a second 
version of the program; / 

after installation of the downloaded update, determining 
whether the second version of t/he program is operating 
correctly at the network site; / 

in response to incorrect operation of the second version, 
restoring the first version of t^e program for operation at 
the network site; and 

in response to correct operation of the second version at 
the network site: 

distributing the downloaded update to a disparate 
network site operating the first/ version of the program; 

installing the downloaded update to generate the 



second version of the program 
and 

operating the second 



of the first version at the disparate network site. 



at the disparate network site; 



version of the program in place 
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12. A method for updating a first version of a program 
operating at a network site, comprising/: 

in response to an automated/ event, automatically 
downloading from a remote site any upd4te for the program; 

installing a downloaded update to generate a second 
version of the program; and j 

operating the second version of the program in place of 
the first version at the network si^te; 

broadcasting over a network an update message; 

receiving in response to the /update message a request for 
the downloaded update from each/ of a plurality of disparate 
network sites operating the first version of the program; 

distributing the downloaded update to the disparate 
network sites requesting the downloaded update; 

installing the downloaded update to generate the second 
version of the program at eacfL of the disparate network sites; 
and 

operating the second version of the program in place of 
the first version at each of/ the disparate network sites. 



13. The method of Claim 12, further comprising: 

receiving a recovery event at one of the network sites; 

automatically restoring the first version of the program 
at the network site at whicrh the recovery event was received; 

broadcasting a recoviery message from the network site 
over the network; and / 

automatically restoring the first version of the program 
at each of the remaining network sites operating the second 
version of the program. 
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15. (Cancelled) 
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19. (Cancelled) 



20. (Cancelled) 



21. (Cancelled) 



22. An intrusion detection system, comprising: 
a private network including a plurality of sites 
connected to a public network, each site including an 
intrusion detection sensor / operating with a first set of 
intrusion detection signatures; and 

each of the intrusion detection sensors operable to 
automatically download from a remote site any update for the 
intrusion detection signatures in response to a specified 



event, to install a downloaded update to generate a second set 
of intrusion detection signatures, to operate with the second 
set of intrusion detection signatures, and to distribute the 
downloaded update to the ^remaining intrusion detection sensors 
for installation. 



23. The system of Glaim 22, wherein the specified event 
is an automated event. 
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24. The system of Claim 23 , wherein the automated event 
is a timed event. 
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